max-nestjs 0.0.4 → 0.0.5

package/dist/index.d.ts

@@ -2,6 +2,7 @@ export * from './max.constants';
 export * from './max.interface';
 export * from './max.module';
 export * from './max-auth.guard';
+export * from './max.validation';
 export { MaxUser } from './max-user.decorator';
 export type { MaxInitData, MaxRequest, MaxUserData } from './types';
 export type { MaxBridgeInitData, MaxBridgeInitDataChat, MaxBridgeInitDataUser } from 'max-bridge';

package/dist/index.js

@@ -19,6 +19,7 @@ __exportStar(require("./max.constants"), exports);
 __exportStar(require("./max.interface"), exports);
 __exportStar(require("./max.module"), exports);
 __exportStar(require("./max-auth.guard"), exports);
+__exportStar(require("./max.validation"), exports);
 var max_user_decorator_1 = require("./max-user.decorator");
 Object.defineProperty(exports, "MaxUser", { enumerable: true, get: function () { return max_user_decorator_1.MaxUser; } });
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,kDAA+B;AAC/B,kDAA+B;AAC/B,+CAA4B;AAC5B,mDAAgC;AAChC,2DAA8C;AAArC,6GAAA,OAAO,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,kDAA+B;AAC/B,kDAA+B;AAC/B,+CAA4B;AAC5B,mDAAgC;AAChC,mDAAgC;AAChC,2DAA8C;AAArC,6GAAA,OAAO,OAAA"}

package/dist/max-auth.guard.d.ts

@@ -1,9 +1,9 @@
 import { CanActivate, type ExecutionContext } from '@nestjs/common';
 import type { MaxResolvedModuleOptions } from './max.interface';
+import { MaxValidationService } from './max.validation';
 export declare class MaxAuthGuard implements CanActivate {
     private readonly options;
-    constructor(options: MaxResolvedModuleOptions);
+    private readonly maxValidationService;
+    constructor(options: MaxResolvedModuleOptions, maxValidationService: MaxValidationService);
     canActivate(context: ExecutionContext): boolean;
-    private validateInitData;
-    private parseInitData;
 }

package/dist/max-auth.guard.js

@@ -15,12 +15,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.MaxAuthGuard = void 0;
 const common_1 = require("@nestjs/common");
 const max_constants_1 = require("./max.constants");
-const crypto_1 = require("crypto");
-const max_constants_2 = require("./max.constants");
-const utils_nodejs_1 = require("@companix/utils-nodejs");
+const max_validation_1 = require("./max.validation");
 let MaxAuthGuard = class MaxAuthGuard {
-    constructor(options) {
+    constructor(options, maxValidationService) {
         this.options = options;
+        this.maxValidationService = maxValidationService;
     }
     canActivate(context) {
         const request = context.switchToHttp().getRequest();
@@ -28,89 +27,15 @@ let MaxAuthGuard = class MaxAuthGuard {
         if (!rawInitData || typeof rawInitData !== 'string') {
             throw new common_1.UnauthorizedException('MAX init data is missing');
         }
-        try {
-            const { initData, entities } = this.parseInitData(rawInitData);
-            if (!this.validateInitData(entities, initData.hash)) {
-                throw new common_1.UnauthorizedException('Invalid MAX init data signature');
-            }
-            request.maxInitData = initData;
-            request.maxUser = initData.user;
-            return true;
-        }
-        catch (error) {
-            if (error instanceof common_1.HttpException) {
-                throw error;
-            }
-            throw new common_1.UnauthorizedException('Failed to validate Max init data');
-        }
-    }
-    validateInitData(entities, hash) {
-        const dataCheckString = entities
-            .filter(([key]) => key !== 'hash')
-            .sort(([leftKey], [rightKey]) => leftKey.localeCompare(rightKey))
-            .map(([key, value]) => `${key}=${value}`)
-            .join('\n');
-        const secretKey = (0, crypto_1.createHmac)('sha256', max_constants_2.MAX_WEB_APP_DATA_KEY).update(this.options.botToken).digest();
-        const calculatedHash = (0, crypto_1.createHmac)('sha256', secretKey).update(dataCheckString).digest('hex');
-        return (0, utils_nodejs_1.safeEqual)(calculatedHash, hash);
-    }
-    parseInitData(rawInitData) {
-        const params = new URLSearchParams(rawInitData);
-        const entities = Array.from(params.entries());
-        const initData = {};
-        for (const [key, value] of entities) {
-            switch (key) {
-                case 'auth_date':
-                    initData.auth_date = parseRequiredInteger(key, value);
-                    break;
-                case 'hash':
-                    initData.hash = value;
-                    break;
-                case 'ip':
-                    initData.ip = value;
-                    break;
-                case 'query_id':
-                    initData.query_id = value;
-                    break;
-                case 'start_param':
-                    initData.start_param = value;
-                    break;
-                case 'chat':
-                    initData.chat = parseJsonValue(key, value);
-                    break;
-                case 'user':
-                    initData.user = parseJsonValue(key, value);
-                    break;
-            }
-        }
-        if (!initData.hash || !initData.auth_date || !initData.user) {
-            throw new common_1.BadRequestException('Invalid init data format');
-        }
-        return {
-            entities,
-            initData: initData
-        };
+        const initData = this.maxValidationService.verify(rawInitData);
+        request.maxInitData = initData;
+        return true;
     }
 };
 exports.MaxAuthGuard = MaxAuthGuard;
 exports.MaxAuthGuard = MaxAuthGuard = __decorate([
     (0, common_1.Injectable)(),
     __param(0, (0, common_1.Inject)(max_constants_1.MAX_OPTIONS_SYMBOL)),
-    __metadata("design:paramtypes", [Object])
+    __metadata("design:paramtypes", [Object, max_validation_1.MaxValidationService])
 ], MaxAuthGuard);
-const parseRequiredInteger = (key, value) => {
-    const parsed = Number.parseInt(value, 10);
-    if (!Number.isFinite(parsed)) {
-        throw new common_1.BadRequestException(`Invalid MAX init data numeric value for "${key}"`);
-    }
-    return parsed;
-};
-const parseJsonValue = (key, value) => {
-    try {
-        return JSON.parse(value);
-    }
-    catch {
-        throw new common_1.BadRequestException(`Invalid MAX init data JSON value for "${key}"`);
-    }
-};
 //# sourceMappingURL=max-auth.guard.js.map

package/dist/max-auth.guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"max-auth.guard.js","sourceRoot":"","sources":["../src/max-auth.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAQuB;AACvB,mDAAoD;AAGpD,mCAAmC;AACnC,mDAAsD;AAEtD,yDAAkD;AAG3C,IAAM,YAAY,GAAlB,MAAM,YAAY;IACvB,YAEmB,OAAiC;QAAjC,YAAO,GAAP,OAAO,CAA0B;IACjD,CAAC;IAEG,WAAW,CAAC,OAAyB;QAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAc,CAAA;QAC/D,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;QAE5D,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACpD,MAAM,IAAI,8BAAqB,CAAC,0BAA0B,CAAC,CAAA;QAC7D,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAA;YAE9D,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpD,MAAM,IAAI,8BAAqB,CAAC,iCAAiC,CAAC,CAAA;YACpE,CAAC;YAED,OAAO,CAAC,WAAW,GAAG,QAAQ,CAAA;YAC9B,OAAO,CAAC,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAA;YAE/B,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,sBAAa,EAAE,CAAC;gBACnC,MAAM,KAAK,CAAA;YACb,CAAC;YAED,MAAM,IAAI,8BAAqB,CAAC,kCAAkC,CAAC,CAAA;QACrE,CAAC;IACH,CAAC;IAEO,gBAAgB,CAAC,QAA4B,EAAE,IAAY;QACjE,MAAM,eAAe,GAAG,QAAQ;aAC7B,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,MAAM,CAAC;aACjC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;aAChE,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC;aACxC,IAAI,CAAC,IAAI,CAAC,CAAA;QAEb,MAAM,SAAS,GAAG,IAAA,mBAAU,EAAC,QAAQ,EAAE,oCAAoB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAA;QACnG,MAAM,cAAc,GAAG,IAAA,mBAAU,EAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAE5F,OAAO,IAAA,wBAAS,EAAC,cAAc,EAAE,IAAI,CAAC,CAAA;IACxC,CAAC;IAEO,aAAa,CAAC,WAAmB;QACvC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,WAAW,CAAC,CAAA;QAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;QAC7C,MAAM,QAAQ,GAAyB,EAAE,CAAA;QAEzC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,QAAQ,EAAE,CAAC;YACpC,QAAQ,GAAG,EAAE,CAAC;gBACZ,KAAK,WAAW;oBACd,QAAQ,CAAC,SAAS,GAAG,oBAAoB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;oBACrD,MAAK;gBACP,KAAK,MAAM;oBACT,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAA;oBACrB,MAAK;gBACP,KAAK,IAAI;oBACP,QAAQ,CAAC,EAAE,GAAG,KAAK,CAAA;oBACnB,MAAK;gBACP,KAAK,UAAU;oBACb,QAAQ,CAAC,QAAQ,GAAG,KAAK,CAAA;oBACzB,MAAK;gBACP,KAAK,aAAa;oBAChB,QAAQ,CAAC,WAAW,GAAG,KAAK,CAAA;oBAC5B,MAAK;gBACP,KAAK,MAAM;oBACT,QAAQ,CAAC,IAAI,GAAG,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;oBAC1C,MAAK;gBACP,KAAK,MAAM;oBACT,QAAQ,CAAC,IAAI,GAAG,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;oBAC1C,MAAK;YACT,CAAC;QACH,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC5D,MAAM,IAAI,4BAAmB,CAAC,0BAA0B,CAAC,CAAA;QAC3D,CAAC;QAED,OAAO;YACL,QAAQ;YACR,QAAQ,EAAE,QAAuB;SAClC,CAAA;IACH,CAAC;CACF,CAAA;AAvFY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,kCAAkB,CAAC,CAAA;;GAFlB,YAAY,CAuFxB;AAED,MAAM,oBAAoB,GAAG,CAAC,GAAW,EAAE,KAAa,EAAU,EAAE;IAClE,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAEzC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,4BAAmB,CAAC,4CAA4C,GAAG,GAAG,CAAC,CAAA;IACnF,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAED,MAAM,cAAc,GAAG,CAAI,GAAW,EAAE,KAAa,EAAK,EAAE;IAC1D,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAM,CAAA;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,4BAAmB,CAAC,yCAAyC,GAAG,GAAG,CAAC,CAAA;IAChF,CAAC;AACH,CAAC,CAAA"}
+{"version":3,"file":"max-auth.guard.js","sourceRoot":"","sources":["../src/max-auth.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAMuB;AACvB,mDAAoD;AAGpD,qDAAuD;AAGhD,IAAM,YAAY,GAAlB,MAAM,YAAY;IACvB,YAEmB,OAAiC,EACjC,oBAA0C;QAD1C,YAAO,GAAP,OAAO,CAA0B;QACjC,yBAAoB,GAApB,oBAAoB,CAAsB;IAC1D,CAAC;IAEG,WAAW,CAAC,OAAyB;QAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAc,CAAA;QAC/D,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;QAE5D,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACpD,MAAM,IAAI,8BAAqB,CAAC,0BAA0B,CAAC,CAAA;QAC7D,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;QAE9D,OAAO,CAAC,WAAW,GAAG,QAAQ,CAAA;QAE9B,OAAO,IAAI,CAAA;IACb,CAAC;CACF,CAAA;AArBY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,kCAAkB,CAAC,CAAA;6CAEY,qCAAoB;GAJlD,YAAY,CAqBxB"}

package/dist/max-user.decorator.js

@@ -4,7 +4,7 @@ exports.MaxUser = void 0;
 const common_1 = require("@nestjs/common");
 exports.MaxUser = (0, common_1.createParamDecorator)((prop = null, ctx) => {
     const request = ctx.switchToHttp().getRequest();
-    const user = request.maxUser;
+    const user = request?.maxInitData?.user;
     if (!user) {
         return null;
     }

package/dist/max-user.decorator.js.map

@@ -1 +1 @@
-{"version":3,"file":"max-user.decorator.js","sourceRoot":"","sources":["../src/max-user.decorator.ts"],"names":[],"mappings":";;;AAAA,2CAA4E;AAG/D,QAAA,OAAO,GAAG,IAAA,6BAAoB,EACzC,CAAC,OAAiC,IAAI,EAAE,GAAqB,EAAE,EAAE;IAC/D,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC,UAAU,EAAc,CAAA;IAC3D,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAA;IAE5B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACjC,CAAC,CACF,CAAA"}
+{"version":3,"file":"max-user.decorator.js","sourceRoot":"","sources":["../src/max-user.decorator.ts"],"names":[],"mappings":";;;AAAA,2CAA4E;AAG/D,QAAA,OAAO,GAAG,IAAA,6BAAoB,EACzC,CAAC,OAAiC,IAAI,EAAE,GAAqB,EAAE,EAAE;IAC/D,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC,UAAU,EAAc,CAAA;IAC3D,MAAM,IAAI,GAAG,OAAO,EAAE,WAAW,EAAE,IAAI,CAAA;IAEvC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACjC,CAAC,CACF,CAAA"}

package/dist/max.module.js

@@ -11,6 +11,7 @@ exports.MaxModule = void 0;
 const common_1 = require("@nestjs/common");
 const max_constants_1 = require("./max.constants");
 const max_auth_guard_1 = require("./max-auth.guard");
+const max_validation_1 = require("./max.validation");
 let MaxModule = MaxModule_1 = class MaxModule {
     static forRoot(options) {
         return {
@@ -20,9 +21,10 @@ let MaxModule = MaxModule_1 = class MaxModule {
                     provide: max_constants_1.MAX_OPTIONS_SYMBOL,
                     useValue: normalizeOptions(options)
                 },
+                max_validation_1.MaxValidationService,
                 max_auth_guard_1.MaxAuthGuard
             ],
-            exports: [max_constants_1.MAX_OPTIONS_SYMBOL, max_auth_guard_1.MaxAuthGuard],
+            exports: [max_constants_1.MAX_OPTIONS_SYMBOL, max_auth_guard_1.MaxAuthGuard, max_validation_1.MaxValidationService],
             global: true
         };
     }

package/dist/max.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"max.module.js","sourceRoot":"","sources":["../src/max.module.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAAmE;AACnE,mDAAkF;AAElF,qDAA+C;AAIxC,IAAM,SAAS,iBAAf,MAAM,SAAS;IACb,MAAM,CAAC,OAAO,CAAC,OAAyB;QAC7C,OAAO;YACL,MAAM,EAAE,WAAS;YACjB,SAAS,EAAE;gBACT;oBACE,OAAO,EAAE,kCAAkB;oBAC3B,QAAQ,EAAE,gBAAgB,CAAC,OAAO,CAAC;iBACpC;gBACD,6BAAY;aACb;YACD,OAAO,EAAE,CAAC,kCAAkB,EAAE,6BAAY,CAAC;YAC3C,MAAM,EAAE,IAAI;SACb,CAAA;IACH,CAAC;CACF,CAAA;AAfY,8BAAS;oBAAT,SAAS;IAFrB,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,SAAS,CAerB;AAED,MAAM,gBAAgB,GAAG,CAAC,OAAyB,EAA4B,EAAE;IAC/E,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAA;IAExC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;IAC9C,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,4CAA4B,CAAA;IAE7E,OAAO;QACL,QAAQ;QACR,UAAU;KACX,CAAA;AACH,CAAC,CAAA"}
+{"version":3,"file":"max.module.js","sourceRoot":"","sources":["../src/max.module.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAAmE;AACnE,mDAAkF;AAElF,qDAA+C;AAC/C,qDAAuD;AAIhD,IAAM,SAAS,iBAAf,MAAM,SAAS;IACb,MAAM,CAAC,OAAO,CAAC,OAAyB;QAC7C,OAAO;YACL,MAAM,EAAE,WAAS;YACjB,SAAS,EAAE;gBACT;oBACE,OAAO,EAAE,kCAAkB;oBAC3B,QAAQ,EAAE,gBAAgB,CAAC,OAAO,CAAC;iBACpC;gBACD,qCAAoB;gBACpB,6BAAY;aACb;YACD,OAAO,EAAE,CAAC,kCAAkB,EAAE,6BAAY,EAAE,qCAAoB,CAAC;YACjE,MAAM,EAAE,IAAI;SACb,CAAA;IACH,CAAC;CACF,CAAA;AAhBY,8BAAS;oBAAT,SAAS;IAFrB,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,SAAS,CAgBrB;AAED,MAAM,gBAAgB,GAAG,CAAC,OAAyB,EAA4B,EAAE;IAC/E,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAA;IAExC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;IAC9C,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,4CAA4B,CAAA;IAE7E,OAAO;QACL,QAAQ;QACR,UAAU;KACX,CAAA;AACH,CAAC,CAAA"}

package/dist/max.validation.d.ts

@@ -0,0 +1,9 @@
+import type { MaxResolvedModuleOptions } from './max.interface';
+import type { MaxInitData } from './types';
+export declare class MaxValidationService {
+    private readonly options;
+    constructor(options: MaxResolvedModuleOptions);
+    verify(rawInitData: string): MaxInitData;
+    private validateInitData;
+    private parseInitData;
+}

package/dist/max.validation.js

@@ -0,0 +1,108 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MaxValidationService = void 0;
+const common_1 = require("@nestjs/common");
+const crypto_1 = require("crypto");
+const max_constants_1 = require("./max.constants");
+const utils_nodejs_1 = require("@companix/utils-nodejs");
+let MaxValidationService = class MaxValidationService {
+    constructor(options) {
+        this.options = options;
+    }
+    verify(rawInitData) {
+        try {
+            const { initData, entities } = this.parseInitData(rawInitData);
+            if (!this.validateInitData(entities, initData.hash)) {
+                throw new common_1.UnauthorizedException('Invalid MAX init data signature');
+            }
+            return initData;
+        }
+        catch (error) {
+            if (error instanceof common_1.HttpException) {
+                throw error;
+            }
+            throw new common_1.UnauthorizedException('Failed to validate Max init data');
+        }
+    }
+    validateInitData(entities, hash) {
+        const dataCheckString = entities
+            .filter(([key]) => key !== 'hash')
+            .sort(([leftKey], [rightKey]) => leftKey.localeCompare(rightKey))
+            .map(([key, value]) => `${key}=${value}`)
+            .join('\n');
+        const secretKey = (0, crypto_1.createHmac)('sha256', max_constants_1.MAX_WEB_APP_DATA_KEY).update(this.options.botToken).digest();
+        const calculatedHash = (0, crypto_1.createHmac)('sha256', secretKey).update(dataCheckString).digest('hex');
+        return (0, utils_nodejs_1.safeEqual)(calculatedHash, hash);
+    }
+    parseInitData(rawInitData) {
+        const params = new URLSearchParams(rawInitData);
+        const entities = Array.from(params.entries());
+        const initData = {};
+        for (const [key, value] of entities) {
+            switch (key) {
+                case 'auth_date':
+                    initData.auth_date = parseRequiredInteger(key, value);
+                    break;
+                case 'hash':
+                    initData.hash = value;
+                    break;
+                case 'ip':
+                    initData.ip = value;
+                    break;
+                case 'query_id':
+                    initData.query_id = value;
+                    break;
+                case 'start_param':
+                    initData.start_param = value;
+                    break;
+                case 'chat':
+                    initData.chat = parseJsonValue(key, value);
+                    break;
+                case 'user':
+                    initData.user = parseJsonValue(key, value);
+                    break;
+            }
+        }
+        if (!initData.hash || !initData.auth_date || !initData.user) {
+            throw new common_1.BadRequestException('Invalid init data format');
+        }
+        return {
+            entities,
+            initData: initData
+        };
+    }
+};
+exports.MaxValidationService = MaxValidationService;
+exports.MaxValidationService = MaxValidationService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(max_constants_1.MAX_OPTIONS_SYMBOL)),
+    __metadata("design:paramtypes", [Object])
+], MaxValidationService);
+const parseRequiredInteger = (key, value) => {
+    const parsed = Number.parseInt(value, 10);
+    if (!Number.isFinite(parsed)) {
+        throw new common_1.BadRequestException(`Invalid MAX init data numeric value for "${key}"`);
+    }
+    return parsed;
+};
+const parseJsonValue = (key, value) => {
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        throw new common_1.BadRequestException(`Invalid MAX init data JSON value for "${key}"`);
+    }
+};
+//# sourceMappingURL=max.validation.js.map

package/dist/max.validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"max.validation.js","sourceRoot":"","sources":["../src/max.validation.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAMuB;AAEvB,mCAAmC;AACnC,mDAA0E;AAE1E,yDAAkD;AAG3C,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAC/B,YAEmB,OAAiC;QAAjC,YAAO,GAAP,OAAO,CAA0B;IACjD,CAAC;IAEG,MAAM,CAAC,WAAmB;QAC/B,IAAI,CAAC;YACH,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAA;YAE9D,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpD,MAAM,IAAI,8BAAqB,CAAC,iCAAiC,CAAC,CAAA;YACpE,CAAC;YAED,OAAO,QAAQ,CAAA;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,sBAAa,EAAE,CAAC;gBACnC,MAAM,KAAK,CAAA;YACb,CAAC;YAED,MAAM,IAAI,8BAAqB,CAAC,kCAAkC,CAAC,CAAA;QACrE,CAAC;IACH,CAAC;IAEO,gBAAgB,CAAC,QAA4B,EAAE,IAAY;QACjE,MAAM,eAAe,GAAG,QAAQ;aAC7B,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,MAAM,CAAC;aACjC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;aAChE,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC;aACxC,IAAI,CAAC,IAAI,CAAC,CAAA;QAEb,MAAM,SAAS,GAAG,IAAA,mBAAU,EAAC,QAAQ,EAAE,oCAAoB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAA;QACnG,MAAM,cAAc,GAAG,IAAA,mBAAU,EAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAE5F,OAAO,IAAA,wBAAS,EAAC,cAAc,EAAE,IAAI,CAAC,CAAA;IACxC,CAAC;IAEO,aAAa,CAAC,WAAmB;QACvC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,WAAW,CAAC,CAAA;QAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;QAC7C,MAAM,QAAQ,GAAyB,EAAE,CAAA;QAEzC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,QAAQ,EAAE,CAAC;YACpC,QAAQ,GAAG,EAAE,CAAC;gBACZ,KAAK,WAAW;oBACd,QAAQ,CAAC,SAAS,GAAG,oBAAoB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;oBACrD,MAAK;gBACP,KAAK,MAAM;oBACT,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAA;oBACrB,MAAK;gBACP,KAAK,IAAI;oBACP,QAAQ,CAAC,EAAE,GAAG,KAAK,CAAA;oBACnB,MAAK;gBACP,KAAK,UAAU;oBACb,QAAQ,CAAC,QAAQ,GAAG,KAAK,CAAA;oBACzB,MAAK;gBACP,KAAK,aAAa;oBAChB,QAAQ,CAAC,WAAW,GAAG,KAAK,CAAA;oBAC5B,MAAK;gBACP,KAAK,MAAM;oBACT,QAAQ,CAAC,IAAI,GAAG,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;oBAC1C,MAAK;gBACP,KAAK,MAAM;oBACT,QAAQ,CAAC,IAAI,GAAG,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;oBAC1C,MAAK;YACT,CAAC;QACH,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC5D,MAAM,IAAI,4BAAmB,CAAC,0BAA0B,CAAC,CAAA;QAC3D,CAAC;QAED,OAAO;YACL,QAAQ;YACR,QAAQ,EAAE,QAAuB;SAClC,CAAA;IACH,CAAC;CACF,CAAA;AA7EY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,kCAAkB,CAAC,CAAA;;GAFlB,oBAAoB,CA6EhC;AAED,MAAM,oBAAoB,GAAG,CAAC,GAAW,EAAE,KAAa,EAAU,EAAE;IAClE,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAEzC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,4BAAmB,CAAC,4CAA4C,GAAG,GAAG,CAAC,CAAA;IACnF,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAED,MAAM,cAAc,GAAG,CAAI,GAAW,EAAE,KAAa,EAAK,EAAE;IAC1D,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAM,CAAA;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,4BAAmB,CAAC,yCAAyC,GAAG,GAAG,CAAC,CAAA;IAChF,CAAC;AACH,CAAC,CAAA"}

package/dist/types.d.ts

@@ -9,5 +9,4 @@ export interface MaxInitData extends Omit<Partial<MaxBridgeInitData>, 'hash' | '
 }
 export interface MaxRequest extends Request {
     maxInitData: MaxInitData;
-    maxUser: MaxUserData;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "max-nestjs",
-  "version": "0.0.4",
+  "version": "0.0.5",
   "description": "NestJS helpers for validating MAX Mini App init data.",
   "files": [
     "dist",